zmclamdctl is not running after upgrade

[Darren]

We have recently upgraded zcs-4.5.3_GA_733.RHEL4 to zcs-4.5.5_GA_838.RHEL4 OpenSource edition on Centos4.4, previously had no problems.

After the upgrade ClamAv stopps working and I see

ClamAV-clamd: Can't connect to INET socket 127.0.0.1:3310: Connection refused

ClamAv appears to start normally, even when started zmclamdctl individually

zmcontrol start
Host zimbra
        Starting ldap...Done.
        Starting logger...Done.
        Starting mailbox...Done.
        Starting antispam...Done.
        Starting antivirus...Done.
        Starting snmp...Done.
        Starting spell...Done.
        Starting mta...Done.

but zmcontrol status shows otherwise:

zmcontrol status
Host zimbra
        antispam                Running
        antivirus               Stopped
                zmclamdctl is not running
        ldap                    Running
        logger                  Running
        mailbox                 Running
        mta                     Running
        snmp                    Running
        spell                   Running

when restarting the clamd log ends at

Tue May 15 20:50:28 2007 -> +++ Started at Tue May 15 20:50:28 2007
Tue May 15 20:50:29 2007 -> clamd daemon 0.90.2 (OS: linux-gnu, ARCH: i386, CPU: i686)
Tue May 15 20:50:29 2007 -> Log file size limited to 20971520 bytes.
Tue May 15 20:50:29 2007 -> Reading databases from /opt/zimbra/clamav/db

A server reboot seems to clear this and the ClamAV starts normally.
Hope someone can help.
Thanks in Advance.

[jholder]

What happens if you run

zmclamdctl start

Does it stay running?

[Darren]

nope:

 [zimbra@zimbra ~]$ zmclamdctl start
[zimbra@zimbra ~]$ zmcontrol status
Host zimbra
        antispam                Running
        antivirus               Stopped
                zmclamdctl is not running
        ldap                    Running
        logger                  Running
        mailbox                 Running
        mta                     Running
        snmp                    Running
        spell                   Running

Annoyingly, a server reboot usually allows the zmclamdctl to start, but sometimes it doesn't.

[sergiumartin]

darren , could you post the content of /opt/zimbra/clamaav/db ..i had a similar problem ..

[jholder]

I've seen this as on mac and rhel. The clamav engine doesn't want to start up right away. After a while, it seems to resolve it self, and doesn't appear to affect the delivery of mail.

Because it seems to resovle itself, I haven't been able to file a bug to repo

If you get anything, please, file a bug.

[Darren]

my /opt/zimbra/clamav/db
contains:
-rwxr-xr-x 1 zimbra zimbra 200881 May 15 19:27 daily.cvd
-rwxr-xr-x 1 zimbra zimbra 200881 May 4 01:59 daily.cvd.init
-rwxr-xr-x 1 zimbra zimbra 2014018 May 4 01:59 main.cvd.init

I've seen this as on mac and rhel. The clamav engine doesn't want to start up right away. After a while, it seems to resolve it self, and doesn't appear to affect the delivery of mail.

Because it seems to resovle itself, I haven't been able to file a bug to repo

If you get anything, please, file a bug.

This does sound like the same error. Eventually the clamav restarts itself and then deferred mail can be delivered.

[vginders]

FYI, this issue remains after 4.5>5beta3 upgrade.

[dijichi2]

yup I spent an hour trying to debug this the other day. if you start the clamd by hand as zimbra user, independent of zimbra (ie with zimbra stopped), it works fine and binds to the port after a short startup delay. if started using zmclamdctl(/zmamavisdctl) then it refuses to bind to the port. this is the same even if you specify the ip/port. strace shows the port binding but it doesn't respond.

i gave up and downloaded the latest clamav source (0.91.2 or something, quite a bit newer than the existing version) and compiled and installed as thus:
./configure --prefix=/opt/zimbra/clamav --with-user=zimbra --with-group=zimbra --with-dbdir=/opt/zimbra/clamav/db --enable-debug && make && make install

works perfectly since then.

[vginders]

I forgot to mention, that altough the status says 'not running', it seems to run fine:

zimbra@goldorak:~$ zmcontrol status
Host goldorak.lan.vanginderachter.be
antispam Running
antivirus Stopped
zmclamdctl is not running
ldap Running
logger Running
mailbox Running
mta Running
snmp Running
spell Running

ps x -u zimbra
...
17467 ? Ss 0:00 /opt/zimbra/clamav/bin/freshclam --config-file=/opt/zimbra/conf/freshclam.conf -d --checks=12
17468 ? Rs 0:01 /opt/zimbra/clamav/sbin/clamd --config-file /opt/zimbra/conf/clamd.conf
...

[jholder]

I forgot to mention, that altough the status says 'not running', it seems to run fine:

zimbra@goldorak:~$ zmcontrol status
Host goldorak.lan.vanginderachter.be
antispam Running
antivirus Stopped
zmclamdctl is not running
ldap Running
logger Running
mailbox Running
mta Running
snmp Running
spell Running

ps x -u zimbra
...
17467 ? Ss 0:00 /opt/zimbra/clamav/bin/freshclam --config-file=/opt/zimbra/conf/freshclam.conf -d --checks=12
17468 ? Rs 0:01 /opt/zimbra/clamav/sbin/clamd --config-file /opt/zimbra/conf/clamd.conf
...

Yeah, there's a problem with our watchdog process.
There are two results of that issue:
1) Watchdog doesn't think clamav is running. It really is, but is just loading virus definitions. Because Zimbra doesn't think it's running, it reloads clam. This isn't what's happening here, but can happen. This is fixed in 4.5.7
2) Our watchdog just isn't seeing it quite yet, but delivery should take place. That's what I think is happening here.

john